Re: [PATCH] PCI: Check BAR index for validity

[Bjorn Helgaas <helgaas@xxxxxxxxxx>]

On Tue, Mar 04, 2025 at 03:31:13PM +0100, Philipp Stanner wrote:
> Many functions in PCI use accessor macros such as pci_resource_len(),
> which take a BAR index. That index, however, is never checked for
> validity, potentially resulting in undefined behavior by overflowing the
> array pci_dev.resource in the macro pci_resource_n().
> 
> Since many users of those macros directly assign the accessed value to
> an unsigned integer, the macros cannot be changed easily anymore to
> return -EINVAL for invalid indexes. Consequently, the problem has to be
> mitigated in higher layers.
> 
> Add pci_bar_index_valid(). Use it where appropriate.
> 
> Reported-by: Bingbu Cao <bingbu.cao@xxxxxxxxxxxxxxx>
> Closes: https://lore.kernel.org/all/adb53b1f-29e1-3d14-0e61-351fd2d3ff0d@xxxxxxxxxxxxxxx/
> Signed-off-by: Philipp Stanner <phasta@xxxxxxxxxx>

Applied to pci/devres for v6.15, thanks.

I reversed this:

> +static inline bool pci_bar_index_is_valid(int bar)
> +{
> +	if (bar < 0 || bar >= PCI_NUM_RESOURCES)
> +		return false;
> +
> +	return true;
> +}

so the test describes valid indexes, not invalid ones:

  if (bar >= 0 && bar < PCI_NUM_RESOURCES)
    return true;

  return false;